Everything a hosting business runs on

Best in class, and the mechanism is why. Every account is a container with its own filesystem dataset, its own process space and its own runtime, reached over its own socket. Not a unix user in a shared tree — there is no path from one tenant’s code to another’s files, because they are not in the same filesystem.

Limits are enforced rather than advertised: CPU, memory and process ceilings per plan, and outbound bandwidth shaped on the host side of the interface where nothing inside the container can opt out. The panel itself runs sandboxed, with a capability set narrowed to what it demonstrably needs.

Nothing listens on a port. The web server reaches a site over a unix socket, and the database the same way — a container with no route to MariaDB still uses it. There is no inbound network path into a tenant to find.

A web server compiled in-house rather than taken from the distribution: HTTP/3 and QUIC, Brotli beside gzip, and a full-page cache that can purge a single URL — something stock nginx cannot do, and the reason a page cache here is safe to leave on instead of being a support liability.

Object caching per account on a private socket, and OPcache with JIT and optional preloading. The web server negotiates WebP without anybody installing a plugin, and sends 103 Early Hints so a browser starts fetching stylesheets while PHP is still thinking. Behind an edge or CDN, the real visitor address survives into every log line and every rate limit, so logs, rate limits and blocks still see the visitor rather than the CDN.

Six, all current, all behind the same socket contract — so moving a site from one to another changes nothing around it:

• PHP 8.2, 8.3 and 8.4, side by side on the same node and selectable per domain, with per-version worker pools
• Node.js 22
• Python 3.11
• Ruby 3.1
• .NET 8
• Java (OpenJDK 21)

PHP customers also pick their own extensions from an allow-list, without raising a ticket and without anything they type reaching a package manager.

Real-user timings collected per site, slow-request logs that name the script rather than the symptom, and per-query visibility when a database is the problem.

Support conversations about “the site feels slow” end with a measurement instead of a shrug.

A staging sandbox costs almost nothing. Cloning a 64 MB site allocates 8 KB — measured, not estimated — because a staging copy is a copy-on-write snapshot rather than a copy. It comes up in seconds on its own hostname with its own database, and it only starts consuming disk for the bytes that actually change.

That is the difference between offering every customer a sandbox and rationing them. Break the staging copy, throw it away, make another.

Deployment straight from your customers’ own git remotes — which runs no hooks and no build steps from the repository, because a deploy that executes what it just pulled is a remote shell with a nicer name. A one-click application catalogue, and per-site controls covering the things support tickets are usually about — redirects, error pages, access rules and protected directories. Customers pick their own PHP extensions from a list you approve, without raising a ticket and without anything they type reaching a package manager.

Stopping a site’s PHP does not take its mail down. Mail, FTP, the file manager and the databases live on the host; the container is only the runtime. So a compromised WordPress can be taken off the network while @example.com keeps receiving — on a shared-hosting panel, suspending an account takes the whole account with it, because mail and PHP are the same unix user.

Cached and static pages keep serving too. For a brochure site that is a kind of resilience on one machine with no replica. It is also why the uptime check deliberately asks past the cache: otherwise a dead application answers 200 all day.

Clients configure themselves. A customer types their address and password into Thunderbird, Apple Mail or Outlook and it connects — no server names, no ports, no encryption dropdown, no support ticket. The panel answers the discovery protocols the clients already speak, Outlook’s included, which asks a different question in a different place than everything else does.

On most hosts that is the single largest category of support contact. Here it is handled, and it is the reason the mail platform is worth having rather than merely present.

The rest is complete rather than token: mailboxes, forwarders, autoresponders and lists, spam filtering and virus scanning, and webmail your customers sign into from the panel. Authentication is generated, published and watched — the records that decide whether your mail is trusted are not left as a checklist somebody forgot. Blocklists, the reverse record, the queue and bounces sit on one page, so you find out your address is listed before a customer telephones to tell you.

Authoritative DNS with secondaries kept in step automatically, signing available per zone, and a record editor your customers can be trusted with.

Certificates issue and renew on their own, including wildcards, and cover everything the node answers on — panel, mail and staging included. Bring your own where a customer insists.

MariaDB and PostgreSQL, provisioned per account, with a browser good enough that customers stop asking for phpMyAdmin: paged tables, indexes, and row editing that never hands anyone a live SQL prompt. Import, export, and remote access for the developer who needs it.

Proven weekly, not promised. The panel restores the account whose backup has gone longest unproven into a throwaway container, puts a throwaway web server in front of it, and asks the restored site for a page — without going anywhere near the live one. A backup that lost the files a site needs passes a checksum and fails this. Most hosts cannot say when a restore was last tested, because testing one usually means finding a spare machine.

Nightly, encrypted, and off the node. Customers browse their own snapshots and restore a single file out of one, so “I overwrote it this morning” stops being a support ticket — and a whole account restores when it has to.

Behind that sits the part that matters when a machine is gone for good: everything needed to rebuild a node is sealed to a recovery key generated in your browser and held only by you, with a second key held by us so a lost one is a support call rather than a catastrophe. Migration in from the major panels is supported, and migration out is always available.

Isolation first, then the controls around it: two-factor for staff and customers, sessions you can see and revoke, scoped API keys, and an audit trail naming the person behind every change — including when an operator is working inside a customer’s account.

Policies you can compel across the node, a managed firewall, malware scanning and automatic abuse blocking that expires its own rules and keeps an allowlist, so it catches attackers rather than customers. The defaults are the safe ones.

When an account is deleted, the panel shows exactly what is left behind and lets you destroy it — the awkward question in a data-protection agreement, answered as a screen rather than as a promise.

Setup happens in a browser: the installer prints one link and the panel asks for what it needs. After that it looks after itself — health monitoring, per-site uptime checks that see past the cache, durable background work that survives a restart, and containers brought back automatically after a reboot.

Signed updates verified before a byte is applied, a fleet view when one server becomes several, a full API with a command-line client, and white-labelled reseller accounts when you are ready to sell through other people.

How it will be licensed Overview